MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c
SHA3-384 hash: 986468d421b16a775e8cb39b3eb623b1ec6e122ecafd4278a7db3a930829f70343d94d197a1b4fa01fa926029a7cebe8
SHA1 hash: bdcd08269c84863eace14dc54d64c6f0af41f332
MD5 hash: f468ae483026819d6977e2a5e34ea52a
humanhash: purple-three-enemy-single
File name:f468ae483026819d6977e2a5e34ea52a
Download: download sample
Signature CoinMiner
Create hunting rule
File size:12'945'034 bytes
First seen:2024-07-24 08:57:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 456e8615ad4320c9f54e50319a19df9c (15 x SVCStealer, 10 x BlankGrabber, 5 x CoinMiner)
ssdeep 393216:szuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:szuRIx1W+e5R4qPDXe
TLSH T128D6338693E49DF2FCBA523C96854069E2B1742003F4C98F9BBD81A61F533E15E3FA51
TrID 70.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.ICL) Windows Icons Library (generic) (2059/9)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 04b070f4d2a88801 (5 x CoinMiner)
Reporter zbetcheckin
Tags:64 CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
395
Origin country :
FR FR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Python.Muldrop.16.25653.2991.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a0c1e3a97e13ad9de7a2b5
Tags:
Banker Execution Network Stealth Trojan Kryptik
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Running batch commands
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a file
Searching for the window
DNS request
Using the Windows Management Instrumentation requests
Creating a service
Launching a service
Loading a system driver
Creating a file in the Windows subdirectories
Enabling autorun for a service
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand lolbin microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/66a0c1e33ba51bb345a34c0c/reports/6357f053-143b-4e0a-9f05-aa3fda345d3b/overview
Verdict:
Malicious
Labled as:
Molotov.Generic
Link:
https://www.hybrid-analysis.com/sample/578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbfc7cd6-0970-4388-ac2f-0d1a5aa76da5
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
adwa.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1479908
Signature
AI detected suspicious sample
Contains functionality to infect the boot sector
Detected Stratum mining protocol
Drops PE files to the startup folder
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found pyInstaller with non standard icon
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: Stop multiple services
Stops critical windows services
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1479908 Sample: Q3pEXxmWAD.exe Startdate: 24/07/2024 Architecture: WINDOWS Score: 100 80 pool.supportxmr.com 2->80 82 pool-fr.supportxmr.com 2->82 84 bg.microsoft.map.fastly.net 2->84 88 Multi AV Scanner detection for domain / URL 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 Multi AV Scanner detection for submitted file 2->92 94 6 other signatures 2->94 10 Q3pEXxmWAD.exe 42 2->10         started        14 Q3pEXxmWAD.exe 42 2->14         started        16 cmd.exe 1 2->16         started        18 4 other processes 2->18 signatures3 process4 file5 60 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 10->60 dropped 62 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 10->62 dropped 64 C:\Users\user\AppData\Local\...\python311.dll, PE32+ 10->64 dropped 72 17 other malicious files 10->72 dropped 106 Contains functionality to infect the boot sector 10->106 108 Drops PE files to the startup folder 10->108 110 Found pyInstaller with non standard icon 10->110 20 Q3pEXxmWAD.exe 1 10->20         started        66 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 14->66 dropped 68 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 14->68 dropped 70 C:\Users\user\AppData\Local\...\python311.dll, PE32+ 14->70 dropped 74 17 other malicious files 14->74 dropped 23 Q3pEXxmWAD.exe 14->23         started        112 Modifies power options to not sleep / hibernate 16->112 25 conhost.exe 16->25         started        27 powercfg.exe 1 16->27         started        35 3 other processes 16->35 29 conhost.exe 18->29         started        31 conhost.exe 18->31         started        33 conhost.exe 18->33         started        37 14 other processes 18->37 signatures6 process7 file8 58 C:\Users\user\AppData\...\Q3pEXxmWAD.exe, PE32+ 20->58 dropped 39 cmd.exe 1 20->39         started        42 cmd.exe 1 23->42         started        process9 signatures10 96 Uses powercfg.exe to modify the power settings 39->96 98 Stops critical windows services 39->98 100 Modifies power options to not sleep / hibernate 39->100 44 Blsvr.exe 4 39->44         started        48 conhost.exe 39->48         started        50 Blsvr.exe 42->50         started        52 conhost.exe 42->52         started        process11 file12 76 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 44->76 dropped 78 C:\Users\user\AppData\...\uyfkrbdwixpr.tmp, PE32+ 44->78 dropped 114 Multi AV Scanner detection for dropped file 44->114 116 Found strings related to Crypto-Mining 44->116 118 Writes to foreign memory regions 44->118 122 4 other signatures 44->122 54 conhost.exe 44->54         started        120 Found direct / indirect Syscall (likely to bypass EDR) 50->120 signatures13 process14 dnsIp15 86 pool-fr.supportxmr.com 141.94.96.195, 3333, 49705 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 54->86 102 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 54->102 signatures16 104 Detected Stratum mining protocol 86->104
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c/
Threat name:
Win64.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2024-07-24 00:26:54 UTC
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6dxr6snpfmiufgqqmgu4uw4kwxk2hfix6m4szzmxwxwy62y5noa._file
Verdict:
unknown
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig evasion execution miner persistence pyinstaller
Link:
https://tria.ge/reports/240724-kwlwba1ame/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Launches sc.exe
Suspicious use of SetThreadContext
Power Settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Stops running service(s)
XMRig Miner payload
Suspicious use of NtCreateUserProcessOtherParentProcess
xmrig
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4b57d76b-eb20-482f-9957-99959d38834c
Unpacked files
SH256 hash:
578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c
MD5 hash:
f468ae483026819d6977e2a5e34ea52a
SHA1 hash:
bdcd08269c84863eace14dc54d64c6f0af41f332
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/b7e375a8-e7a2-4b38-9d1a-e0bcfd959e81/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:PyInstaller_Packed_April_2024
Create hunting rule
Author:NDA0E
Description:Detects files packed with PyInstaller
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 578778fa4d79588a14d0830d4e52dc55aead1ca8bf99c9672cbdaf6c7b58eb5c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3064748/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::FindFirstFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments


Avatar
zbet commented on 2024-07-24 08:57:01 UTC

url : hxxp://185.196.10.57/selectex-file-host/OneDrive.exe